-
-
Notifications
You must be signed in to change notification settings - Fork 939
Closed
Description
Is your feature request related to a problem? Please describe.
The package as it is published on npm currently contains multiple minified files; this is problematic from a security auditing perspective, as minified code is difficult to audit. This is particularly problematic because of the often security-sensitive nature of the uuid
module.
A more detailed explanation of the problem with minified builds and why they are unnecessary to publish in the first place, can be found here.
Describe the solution you'd like
Removing all minified builds from the npm package in a future release, instead either a) providing instructions for users on how to obtain a minified build, or b) if necessary for certain CDNs, publishing the minified builds in a separate package that users wouldn't install into their project.
Describe alternatives you've considered
- Reproducing from source: Requires auditing the entire build stack due to potential supply chain attacks, with build tools being able to modify the code going through them.
- Prettifying minified code and auditing that: Cumbersome, unreliable because a lack of meaningful names makes it hard to understand the code correctly.
- Just not using the minified files: For a reliable dependency audit, all files present in the dependency tree must be audited, because there is (AFAIK) no runtime-level mechanism to block certain files from being loaded in eg. a multi-stage attack.
Additional context
N/A
Metadata
Metadata
Assignees
Labels
No labels